<!DOCTYPE html
  PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  "DTD/xhtml1-strict.dtd">
<html>
  <head>
    <title>volatility.plugins.malware.apihooks.ApiHooks : API documentation</title>
    <meta content="text/html;charset=utf-8" http-equiv="Content-Type" />
    <link href="apidocs.css" type="text/css" rel="stylesheet" />
    
    
  </head>
  <body>
    <h1 class="class">v.p.m.a.ApiHooks(<a href="volatility.plugins.procdump.ProcExeDump.html">procdump.ProcExeDump</a>) : class documentation</h1>
    <p>
      <span id="part">Part of <a href="volatility.html">volatility</a>.<a href="volatility.plugins.html">plugins</a>.<a href="volatility.plugins.malware.html">malware</a>.<a href="volatility.plugins.malware.apihooks.html">apihooks</a></span>
      
      <a href="classIndex.html#volatility.plugins.malware.apihooks.ApiHooks">View In Hierarchy</a>
    </p>
    <div>
      
    </div>
    <div>Detect API hooks in process and kernel memory<table class="fieldTable"></table></div>

    
    
    <div id="splitTables">
      <table class="children sortable" id="id86">
  
  
<tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.apihooks.ApiHooks.html#__init__">__init__</a></td>
    <td><span>Constructor uses args as an initializer. It creates an instance of OptionParser, populates the options, and finally parses the command line. Options are stored in the self.opts attribute.</span></td>
  </tr><tr class="staticmethod">
    
    
    <td>Static Method</td>
    <td><a href="volatility.plugins.malware.apihooks.ApiHooks.html#is_valid_profile">is_valid_profile</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.apihooks.ApiHooks.html#compile">compile</a></td>
    <td><span>Precompile the regular expression rules. Its quicker if we do this once per plugin run, rather than once per API hook that needs checking.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.apihooks.ApiHooks.html#whitelist">whitelist</a></td>
    <td><span>Check if an API hook should be ignored due to whitelisting.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.apihooks.ApiHooks.html#check_syscall">check_syscall</a></td>
    <td><span class="undocumented">No summary</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.apihooks.ApiHooks.html#check_ucpcall">check_ucpcall</a></td>
    <td><span>Scan for calls to unknown code pages.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.apihooks.ApiHooks.html#check_wsp">check_wsp</a></td>
    <td><span class="undocumented">No summary</span></td>
  </tr><tr class="staticmethod">
    
    
    <td>Static Method</td>
    <td><a href="volatility.plugins.malware.apihooks.ApiHooks.html#check_inline">check_inline</a></td>
    <td><span>Check for inline API hooks. We check for direct and indirect calls, direct and indirect jumps, and PUSH/RET combinations.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.apihooks.ApiHooks.html#gather_stuff">gather_stuff</a></td>
    <td><span>Use the Volatility object classes to enumerate imports and exports. This function can be overriden to use pefile instead for speed testing</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.apihooks.ApiHooks.html#get_hooks">get_hooks</a></td>
    <td><span>Enumerate IAT, EAT, Inline hooks. Also acts as a dispatcher for NT syscall, UCP scans, and winsock procedure table hooks.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.apihooks.ApiHooks.html#calculate">calculate</a></td>
    <td><span>Produces a list of processes, or just a single process based on an OFFSET</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.apihooks.ApiHooks.html#render_text">render_text</a></td>
    <td><span>Renders the tasks to disk images, outputting progress as they go</span></td>
  </tr>
  
</table>
      
        <p>
          Inherited from <a href="volatility.plugins.procdump.ProcExeDump.html">ProcExeDump</a>:
        </p>
        <table class="children sortable" id="id87">
  
  
<tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.procdump.ProcExeDump.html#dump_pe">dump_pe</a></td>
    <td><span>Dump a PE from an AS into a file.</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.procdump.ProcExeDump.html#round">round</a></td>
    <td><span>Rounds down an address based on an alignment</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.procdump.ProcExeDump.html#get_nt_header">get_nt_header</a></td>
    <td><span>Returns the NT Header object for a task</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.procdump.ProcExeDump.html#get_code">get_code</a></td>
    <td><span>Returns a single section of re-created data from a file image</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.procdump.ProcExeDump.html#get_image">get_image</a></td>
    <td><span>Outputs an executable disk image of a process</span></td>
  </tr>
  
</table>
      
        <p>
          Inherited from <a href="volatility.plugins.taskmods.DllList.html">DllList</a> (via <a href="volatility.plugins.procdump.ProcExeDump.html">ProcExeDump</a>):
        </p>
        <table class="children sortable" id="id88">
  
  
<tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.taskmods.DllList.html#filter_tasks">filter_tasks</a></td>
    <td><span>Reduce the tasks based on the user selectable PIDS parameter.</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.taskmods.DllList.html#virtual_process_from_physical_offset">virtual_process_from_physical_offset</a></td>
    <td><span>Returns a virtual process from a physical offset in memory</span></td>
  </tr>
  
</table>
      
        <p>
          Inherited from <a href="volatility.commands.Command.html">Command</a> (via <a href="volatility.plugins.procdump.ProcExeDump.html">ProcExeDump</a>, <a href="volatility.plugins.taskmods.DllList.html">DllList</a>, <a href="volatility.plugins.common.AbstractWindowsCommand.html">AbstractWindowsCommand</a>):
        </p>
        <table class="children sortable" id="id89">
  
  
<tr class="basestaticmethod">
    
    
    <td>Static Method</td>
    <td><a href="volatility.commands.Command.html#register_options">register_options</a></td>
    <td><span>Registers options into a config object provided</span></td>
  </tr><tr class="baseclassmethod">
    
    
    <td>Class Method</td>
    <td><a href="volatility.commands.Command.html#help">help</a></td>
    <td><span>This function returns a string that will be displayed when a user lists available plugins.</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#execute">execute</a></td>
    <td><span>Executes the plugin command.</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#format_value">format_value</a></td>
    <td><span>Formats an individual field using the table formatting codes</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#table_header">table_header</a></td>
    <td><span>Table header renders the title row of a table</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#table_row">table_row</a></td>
    <td><span>Outputs a single row of a table</span></td>
  </tr><tr class="basemethod private">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#_formatlookup">_formatlookup</a></td>
    <td><span>Code to turn profile specific values into format specifications</span></td>
  </tr><tr class="basemethod private">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#_elide">_elide</a></td>
    <td><span>Adds three dots in the middle of a string if it is longer than length</span></td>
  </tr>
  
</table>
      
        <p>
          Inherited from <a href="volatility.cache.Testable.html">Testable</a> (via <a href="volatility.plugins.procdump.ProcExeDump.html">ProcExeDump</a>, <a href="volatility.plugins.taskmods.DllList.html">DllList</a>):
        </p>
        <table class="children sortable" id="id90">
  
  
<tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.cache.Testable.html#test">test</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod private">
    
    
    <td>Method</td>
    <td><a href="volatility.cache.Testable.html#_flatten">_flatten</a></td>
    <td><span>Flattens an item, including all generators</span></td>
  </tr>
  
</table>
      
      
    </div>
    
    
    

    <div class="function">
  <a name="volatility.plugins.malware.apihooks.ApiHooks.__init__">
    
  </a>
  <a name="__init__">
    
  </a>
  <div class="functionHeader">
    
    def
    __init__(self, config, *args, **kwargs):
    
  </div>
  <div class="functionBody">
    <div class="interfaceinfo">overrides <a href="volatility.plugins.procdump.ProcExeDump.html#__init__">volatility.plugins.procdump.ProcExeDump.__init__</a></div>
    <div>Constructor uses args as an initializer. It creates an instance
of OptionParser, populates the options, and finally parses the
command line. Options are stored in the self.opts attribute.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.apihooks.ApiHooks.is_valid_profile">
    
  </a>
  <a name="is_valid_profile">
    
  </a>
  <div class="functionHeader">
    @staticmethod<br />
    def
    is_valid_profile(profile):
    
  </div>
  <div class="functionBody">
    <div class="interfaceinfo">overrides <a href="volatility.plugins.common.AbstractWindowsCommand.html#is_valid_profile">volatility.plugins.common.AbstractWindowsCommand.is_valid_profile</a></div>
    <div class="undocumented">Undocumented</div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.apihooks.ApiHooks.compile">
    
  </a>
  <a name="compile">
    
  </a>
  <div class="functionHeader">
    
    def
    compile(self):
    
  </div>
  <div class="functionBody">
    
    <div>Precompile the regular expression rules. Its quicker
if we do this once per plugin run, rather than once per
API hook that needs checking.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.apihooks.ApiHooks.whitelist">
    
  </a>
  <a name="whitelist">
    
  </a>
  <div class="functionHeader">
    
    def
    whitelist(self, rule_key, process, src_mod, dst_mod, function):
    
  </div>
  <div class="functionBody">
    
    <div>Check if an API hook should be ignored due to whitelisting.</p>
<dl class="rst-docutils">
<dt>&#64;param rule_key: a key from the whitelist_rules dictionary which</dt>
<dd>describes the type of hook (i.e. Usermode IAT or Kernel Inline).</dd>
</dl>
<p>&#64;param process: name of the suspected victim process.</p>
<dl class="rst-docutils">
<dt>&#64;param src_mod: name of the source module whose function has been</dt>
<dd>hooked. this varies depending on whether we're dealing with IAT
EAT, inline, etc.</dd>
<dt>&#64;param dst_mod: name of the module that is the destination of the</dt>
<dd>hook pointer. this is usually the rootkit dll, exe, or sys,
however, in many cases there is no module name since the rootkit
is trying to be stealthy.</dd>
</dl>
<p>&#64;param function: name of the function that has been hooked.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.apihooks.ApiHooks.check_syscall">
    
  </a>
  <a name="check_syscall">
    
  </a>
  <div class="functionHeader">
    
    def
    check_syscall(self, addr_space, module, module_group):
    
  </div>
  <div class="functionBody">
    
    <div>Enumerate syscall hooks in ntdll.dll. A syscall hook is one
that modifies the function prologue of an NT API function
(i.e. ntdll!NtCreateFile) or swaps the location of the sysenter
with a malicious address.</p>
<p>&#64;param addr_space: a process AS for the process containing the
ntdll.dll module.</p>
<p>&#64;param module: the _LDR_DATA_TABLE_ENTRY for ntdll.dll</p>
<p>&#64;param module_group: a ModuleGroup instance for the process.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.apihooks.ApiHooks.check_ucpcall">
    
  </a>
  <a name="check_ucpcall">
    
  </a>
  <div class="functionHeader">
    
    def
    check_ucpcall(self, addr_space, module, module_group):
    
  </div>
  <div class="functionBody">
    
    <div>Scan for calls to unknown code pages.</p>
<p>&#64;param addr_space: a kernel AS</p>
<p>&#64;param module: the _LDR_DATA_TABLE_ENTRY to scan</p>
<p>&#64;param module_group: a ModuleGroup instance for the process.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.apihooks.ApiHooks.check_wsp">
    
  </a>
  <a name="check_wsp">
    
  </a>
  <div class="functionHeader">
    
    def
    check_wsp(self, addr_space, module, module_group):
    
  </div>
  <div class="functionBody">
    
    <div>Check for hooks of non-exported WSP* functions. The
mswsock.dll module contains a global variable which
points to all the internal Winsock functions. We find
the function table by the reference from the exported
WSPStartup API.</p>
<p>.text:6C88922E 8B 7D 50          mov     edi, [ebp+lpProcTable]
.text:6C889231 6A 1E             push    1Eh
.text:6C889233 59                pop     ecx
.text:6C889234 BE 40 64 8B 6C    mov     esi, offset _SockProcTable
.text:6C889239 F3 A5             rep movsd</p>
<p>&#64;param addr_space: process AS</p>
<p>&#64;param module: the _LDR_DATA_TABLE_ENTRY for mswsock.dll</p>
<p>&#64;param module_group: a ModuleGroup instance for the process.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.apihooks.ApiHooks.check_inline">
    
  </a>
  <a name="check_inline">
    
  </a>
  <div class="functionHeader">
    @staticmethod<br />
    def
    check_inline(va, addr_space, mem_start, mem_end):
    
  </div>
  <div class="functionBody">
    
    <div>Check for inline API hooks. We check for direct and indirect
calls, direct and indirect jumps, and PUSH/RET combinations.</p>
<p>&#64;param va: the virtual address of the function to check</p>
<p>&#64;param addr_space: process or kernel AS where the function resides</p>
<dl class="rst-docutils">
<dt>&#64;param mem_start: base address of the module containing the</dt>
<dd>function being checked.</dd>
<dt>&#64;param mem_end: end address of the module containing the func</dt>
<dd>being checked.</dd>
</dl>
<p>&#64;returns: a tuple of (hooked, data, hook_address)<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.apihooks.ApiHooks.gather_stuff">
    
  </a>
  <a name="gather_stuff">
    
  </a>
  <div class="functionHeader">
    
    def
    gather_stuff(self, _addr_space, module):
    
  </div>
  <div class="functionBody">
    
    <div>Use the Volatility object classes to enumerate
imports and exports. This function can be overriden
to use pefile instead for speed testing<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.apihooks.ApiHooks.get_hooks">
    
  </a>
  <a name="get_hooks">
    
  </a>
  <div class="functionHeader">
    
    def
    get_hooks(self, hook_mode, addr_space, module, module_group):
    
  </div>
  <div class="functionBody">
    
    <div>Enumerate IAT, EAT, Inline hooks. Also acts as a dispatcher
for NT syscall, UCP scans, and winsock procedure table hooks.</p>
<p>&#64;param hook_mode: one of the HOOK_MODE_* constants</p>
<p>&#64;param addr_space: a process AS or kernel AS</p>
<p>&#64;param module: an _LDR_DATA_TABLE_ENTRY for the module being
checked for hooks.</p>
<p>&#64;param module_group: a ModuleGroup instance for the process.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.apihooks.ApiHooks.calculate">
    
  </a>
  <a name="calculate">
    
  </a>
  <div class="functionHeader">
    
    def
    calculate(self):
    
  </div>
  <div class="functionBody">
    <div class="interfaceinfo">overrides <a href="volatility.plugins.taskmods.DllList.html#calculate">volatility.plugins.taskmods.DllList.calculate</a></div>
    <div>Produces a list of processes, or just a single process based on an OFFSET<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.apihooks.ApiHooks.render_text">
    
  </a>
  <a name="render_text">
    
  </a>
  <div class="functionHeader">
    
    def
    render_text(self, outfd, data):
    
  </div>
  <div class="functionBody">
    <div class="interfaceinfo">overrides <a href="volatility.plugins.procdump.ProcExeDump.html#render_text">volatility.plugins.procdump.ProcExeDump.render_text</a></div>
    <div>Renders the tasks to disk images, outputting progress as they go<table class="fieldTable"></table></div>
  </div>
</div>
    <address>
      <a href="index.html">API Documentation</a> for Volatility 2.2, generated by <a href="http://codespeak.net/~mwh/pydoctor/">pydoctor</a> at 2013-06-24 15:16:10.
    </address>
  </body>
</html>